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We show that the monogamy of entanglement is a sufficient phenomenon in every physical theory, 
if the quantum key distribution is to be safe on the grounds of such theory. To do so we present 
the QKD protocol that is safe in any physical theory under the assumption of the monogamous 
entanglement only. The necessity of this condition is also discussed. 



I. INTRODUCTION 

The quantum cryptography offers us unprecedented 
degree of safety, with the laws of quantum mechanics 
serving as a warranty. Recently the issue of what hap- 
pens to this safety beyond quantum mechanics has been 
raised [l], Both these papers present protocols that 
are safe in the classes of theories that include but are 
not confined to quantum mechanics and both have their 
disadvantages. In [l| authors base the security of their 
protocol on the assumption of no signalling while repeat- 
ing after [3] that every deterministic non-local theory al- 
lows signalling. This excludes the wide range of the most 
promising alternatives to the quantum mechanics, that 
is the non-local, hidden variables theories. The proto- 
col presented in [2] on the other hand is proven secure 
even in the light of de'Broglie-Bohm theory with the ini- 
tial particle positions known to Eve. Unfortunately it is 
the only non-local, realistic theory for which the proof in 
can be validated. The disadvantage shared by both 
these protocols is that their implementation would be 
very difficult. In this paper we present the entangled- 
state cryptographic protocol that is not only secure in 
any non-local, hidden variables theory which involves the 
monogamy of entanglement but also much easier to im- 
plement that those discussed above. The area of this pro- 
tocol's safety includes but is not confined to the classes 
of theories covered by the protocols of [J, |3| ■ In f^^ct it is 
shown that this protocol is safe in every physical theory 
where safe QKD is at all possible. 

II. LIMITATIONS 

We start by setting the necessary limitations on com- 
municating parties and eavesdropper. Though Eve can 
have the knowledge and technology to exploit some yet 
unknown post-quantum theory, Alice and Bob are limited 
to the use of quantum mechanics at its present form. The 
theory used by the eavesdropper must also have three im- 
portant traits in order to allow for safe QKD of any kind. 
Firstly, Eve can not have any influence on or knowledge 
of the choices of the measurements being made at Al- 
ice's and Bob's labs. Secondly, the theory exploited by 
Eve must agree with QM on the outcomes of all the ex- 
periments so far conducted. Finally, the entanglement 



must be monogamous. The necessity of this condition is 
quite obvious. If the entanglement was not monogamous 
there would be no way for Alice and Bob to ascertain 
whether their systems are entangled with some external 
party or not. That party could made the measurements 
after the bases are revealed and get any information that 
is needed. For the proof of sufficiency we present QKD 
protocol which safety is based only on the limitations 
mentioned in this section. 

Before we start we should clarify what is meant by 
the monogamy of entanglement. We will assume that 
the monogamy of entanglement is a property of a the- 
ory that disallows a third party to find anything about 
the outcomes of the measurements done on a maximally 
entangled state by measuring some other system (other 
ways of finding the outcomes are not forbidden). By 
a maximally entangled state we will mean a state for 
which two parties can always expect perfect correlations 
or anti-correlations even if they can choose between the 
measurements in two mutually unbiased bases (as long 
as both parties choose the same base). 

III. PROTOCOL 

Consider the following protocol: 

1. Alice and Bobs receive their parts of the system in 
a singlet state. They both randomly choose two param- 
eters c = 0, ^ and (j) = 0, f , f, f and measure their 
parts of the system in basis 

| + l)=cos(?!) + c)|0)+sin(?!) + c)|l) (1) 
I - 1) = cos(?!) + c)|l) - sm{(l) + c)|0) (2) 

They repeat this whole step for all the states that they 
receive. 

2. They randomly choose an appropriate part of the 
runs of the protocol. In this cases they both reveal their 
bases and measurement outcomes and calculate the ex- 
pectation value from the CHSH inequality (basing on the 
runs where the choice of their bases was right for this in- 
equality). They abort the protocol if it differs from the 
predictions of quantum mechanics for the singlet state, 
that is 2\/2. They also abort the protocol if they do not 
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observe perfect anti-correlations for the same choice of 
the bases and perfect correlations for the choice of bases 
differing by f . 

3. They announce their choices of (but not c) for 
each of the remaining cases. 

4. For each of the remaining cases they randomly 
choose one of the parties. This party reveals its c and 
a random bit XORed with the measurement outcome (of 
course binary numbers have to be first assigned to the 
outcomes). Second party has now the knowledge of both 
bases so he/she knows whether the results are correlated 
or anti-correlated and knowing his/her own result can 
decode the random bit send. 

5. Step 4 is repeated K times, so both parties share a 
set of K bits. From this set one bit of key is generated 
by XORing all the bits form this set. 



outcomes. Eve knows the full structure of the functions 
VF^(A, a, 6) and W^B(A,a,6) which govern the results at 
Alice's and Bob's labs. She also knows hidden param- 
eter A in each case, a and h denote the bases of Alice 
and Bob respectively. Since perfect (anti-) correlations 
are expected in each case (Step 2 guarantees that) these 
functions must obey 

WA{\a,Q)WB{\,a,Q) ^ -WA{\,a,^)WB{\,a,^) (3) 
Wa{\ 0, b)WB{\ 0, b) = ~Wa{\ |, 6)W^b(A, |, 6) (4) 

which is equivalent to 

WA{\,a,Q)WA{\a,^) ^ -WB{\a,Q)WB{\a,^) (5) 
Wa{,\ 0, b)WA{\ |, b) = -Wb{\ 0, b)WB{\ |, 6) (6) 



IV. PROOF OF SAFETY 

If we assume that the standard quantum mechanics is 
right then the Step 2 is enough to be sure that Eve has 
no knowledge of the state Alice and Bob receive and ipso 
facto the key. The protocol is then secure as proved in 
[J|, where the perfect correlations in two mutually unbi- 
ased bases are exploited to prove that the state received 
is indeed maximally entangled. Another way to prove 
the security on the grounds of quantum mechanics is to 
notice that Step 2 uses similar measures to the Ekert's 
original paper [5| . The proof of security for any nonlo- 
cal hidden variable model that includes the monogamy 
of the entanglement is more difficult. We assume that 
the theory known to the eavesdropper is deterministic 
since every probabilistic theory can be simulated by an 
appropriate deterministic model. 

Since we assume the monogamy of the entanglement, 
the only way for Eve to know the results of the experi- 
ment is to have the access to some hidden initial parame- 
ters and know the mechanics (non-local in principle) that 
govern the evolution of the state, so she knows what the 
results of Alice's and Bob's measurements will be for any 
choice of the bases. The only thing that she does not 
know is what bases were actually chosen, since at each 
time only one of them is revealed. This type of attacks 
has already been presented in Q and 0] (actually these 
are the only two papers the author is aware of that pro- 
pose attacks that are beyond the scope of current physical 
theories) . The hidden variables in this papers are particle 
positions and gravitational fields respectively. Since fl] 
deals with the BB84 ^] protocol, the method presented 
there does not apply to the safety of the protocol above. 
Even if Plaga's method could be generahzed, the QKD 
protocol presented here would remain secure against the 
type of attacks presented in as well as in [o]. 

Let us now assign the numbers ±1 to the experiment 



It is clear form ([5]) that for every A and a either Wa or 
Wb changes sign as b changes. From ^ we see that the 
same is true for a. We can now divide the set of As into 
two separate subsets. For A € Ai, W0i(A,a,6) does not 
depend on b and M/B(A,a,6) does not depend on a. We 
will call this set local. The rest of As are in the set A2 
which we will call non-local. 

Let us assume that the parties are now during Step 4 
of the protocol and Eve's A corresponding to this system 
is form the set A2. Depending on the chosen party the 
knowledge of either Wa or Wb is necessary for the de- 
coding of the random bit. At least one of the outcomes 
changes with the change of the other party's base that 
is unknown to Eve, which means that in every case Eve 
does not know at least one of the outcomes. If it is the 
outcome of the chosen party then Eve cannot decode the 
random bit. It happens in 50% of the cases. So if A € A2 
then Eve has the chance 0.5 of knowing the random bit. 
Now it is necessary to estimate the minimal size of the 
subset A2 compared to the whole set of As. 

To do that let us notice that the theory is required 
to give the outcome 2^2 in Step 2. If all the As were 
from the local set this value would be 2. If they all were 
from the non-local set it could be as high as 4. Now it is 
easy to calculate that — 1 of As must be in the non- 
local set (throughout the whole paper we assume that 
the probability for each A to occur is the same - we can 
do this without any loss of generality). 

Now we can conclude that Eve can know the random 
bit with the probability p = ~ 0.79 (She knows the 

bit if A is in the local set and in the half of the cases from 
the non-local one) . Since Step 4 is repeated K times then 
the bit of key generated in Step 5 is known by Eve with 
the probability P = p^ . Increasing K leads to arbitrary 
small probabilities (for K = 20, P < 1% and increasing 
if by 10 reduces P over 10 times). 
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V. DISCUSSION 

The protocol that has been presented uses only the as- 
sumption of monogamous entanglement and thus proves 
that it is the sufficient condition for the safety of quan- 
tum key distribution. 

The necessity and sufficiency of the only assumption 
used by the protocol means that the protocol presented 
is safe in every physical theory where it is possible to 



construct one. Although there is some room for improve- 
ment in the fields of speed and efficiency of the protocol 
and the safety when it comes to physical implementa- 
tions, the safety of this protocol in the terms of physicals 
principles that guarantee it is the highest attainable. 

This work is part of EU 6FP programme QAP. The 
author thanks M. Bourennane, W. Laskowski, T. Paterek 
and M. Zukowski for their important input. 
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